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3 Concepts 

3.1 Payment System Participants 
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Foment messages, including payment instructions from cardholders. 
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3.1 Payment System Participants, continued 



Brand 



Financial institutions have founded payment card brands that protect and advertise the brand, 
establish and enforce rules for use and acceptance of their payment cards, and provide 
networks to interconnect the financial institutions. 

Other brands are owned by financial services companies that advertise the brand, and 
establish and enforce rules for use and acceptance of their payment cards. These brands 
combine the roles of Issuer and Acquirer in interactions with cardholders and merchants. 



Third parties 



Issuers and Acquirers sometimes choose to assign the processing of payment card 
transactions to third-party processors. This document does not distinguish between the 
financial institution and the processor of the transactions. 
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3.2 Cryptography 



Cryptography has been used for centuries to protect sensitive information as it is transmitted 
from one location to another. In a cryptographic system, a message is encrypted using a key. 
The resulting ciphertext is then transmitted to the recipient where it is decrypted using a key 
to produce the original message. There are two primary encryption methods in use today: 
secret-key cryptography and public-key cryptography. SET uses both methods in its 
encryption process. 



Secret-key cryptography, also known as symmetric cryptography, uses the same key to 
encrypt and decrypt the message. Therefore, the sender and the recipient of a message must 
share a secret, namely the key. A well known secret-key cryptography algorithm is the Data 
Encryption Standard (DES), which is used by financial institutions to encrypt PINs (personal 
identification numbers). 



Secret-Key Cryptography 




Figure 1: Secret-Key Cryptography 
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3.2 Cryptography, continued 



C^ptoiaDhv Public - ke y cryptography, also known as asymmetric cryptography, uses two keys: one key to 

crypiograpny encrypt the message and , he other key (o decrypt ^ ^ ^ y 

mathematically related so that data encrypted with either key can only be decrypted usin» the 
otherEach user has two keys: a public key and a private key. The user distributes the public 
key Because of the relationship between the two keys, the user and anyone receiving the 
public key can be assured that data encrypted with the public key and sent to the user can 
only be decrypted when the user uses the private key. This assurance is only maintained if 
the user ensures that the private key is not disclosed to anyone else. Therefore, the kev pair 
should be generated by the user. The best known public-key cryptography algorithm is RSA 
(named after its inventors Rivest, Shamir, and Adleman). 




Figure 2: Public-Key Cryptography 

Secret-key cryptography is impractical for exchanging messages with a large group of 
previously unknown correspondents over a public network. For a merchant to conduct 
transact.ons securely with millions of Internet subscribers, each consumer would need a 
distinct key assigned by that merchant and transmitted over a separate secure channel On the 
other hand, by using public-key cryptography, that same merchant could create a 
publ.c/pnvate key pair and publish the public key, allowing any consumer to send a secure 
message to that merchant. 
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